Red Hat Security AdvisoryRHSA-2025:4568
libsoup security update
Released 2025-05-06 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream EUS (v.8.8) libsoup-devel-2.62.3-3.el8_8.4
- Red Hat Enterprise Linux BaseOS EUS (v.8.8) libsoup-2.62.3-3.el8_8.4
Fixes 8 records
Priority MEDIUM 43
A use-after-free type vulnerability was found in libsoup, in the soup_message_headers_get_content_disposition() function.
CVSS 3.1CRITICAL 9.0· Network · No auth · No interaction · EPSS 0.00966 · Published 2025-04-15 · Partial fix · 3.6.3, 2.62.2-9.el7_9 +11 CWE-590
Priority MEDIUM 40
A flaw was found in libsoup, where the soup_message_headers_get_content_disposition() function is vulnerable to a NULL pointer dereference.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00856 · Published 2025-04-14 · Partial fix · 3.6.2, 2.62.2-9.el7_9 +11 CWE-476
Priority LOW 36
A flaw was found in libsoup.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00669 · Published 2025-04-03 · Partial fix · 3.6.1, 2.62.3-8.el8_10 +6 CWE-126
Priority LOW 36
A flaw was found in libsoup.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00669 · Published 2025-04-03 · Partial fix · 3.6.1, 2.62.3-8.el8_10 +6 CWE-126
Priority LOW 35
A flaw was found in libsoup, where the soup_headers_parse_request() function may be vulnerable to an out-of-bound read.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01286 · Published 2025-04-14 · Partial fix · 3.6.5, 3.6.5-3.el10_0 +12 CWE-125
Priority LOW 33
A flaw was found in libsoup.
CVSS 3.1MEDIUM 6.8· Network · No auth · User interaction · EPSS 0.00583 · Published 2025-04-24 · Partial fix · 3.6.5, 3.6.5-3.el10_0 +9 CWE-497
Priority LOW 30
A flaw was found in libsoup.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00594 · Published 2025-04-24 · Partial fix · 3.6.3, 2.62.3-8.el8_10 +8 CWE-401
Priority LOW 28
A flaw was found in libsoup.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.0078 · Published 2025-04-03 · Partial fix · 3.6.1, 2.62.3-8.el8_10 +6 CWE-127
THREATIST.IORead the docs